General

  • Target

    6d182b71073138fd1cf35b5ecc4427023632ea7fa4c4b1797c112185780197ca

  • Size

    145KB

  • Sample

    241217-3nm3hstqfn

  • MD5

    fddb8d53b37ce3f4f403db977f080c75

  • SHA1

    31493745f52b4ed0ae6a14256a561b0b0cb5c693

  • SHA256

    6d182b71073138fd1cf35b5ecc4427023632ea7fa4c4b1797c112185780197ca

  • SHA512

    07e95cf36f08a702a07c21e4c59c93ea9bbdf4ff91c705c57894108b95d10cc1bc140654ac29aca8dc3cfaa57578b5806be184a43b50b8b1a2f754bb1588b6b9

  • SSDEEP

    1536:JxqjQ+P04wsmJCDNu4GhQkfnLq01weW5yX3jFxv44fvQ+P04wsmJC:sr85ChTGhQl3yRr85C

Malware Config

Targets

    • Target

      6d182b71073138fd1cf35b5ecc4427023632ea7fa4c4b1797c112185780197ca

    • Size

      145KB

    • MD5

      fddb8d53b37ce3f4f403db977f080c75

    • SHA1

      31493745f52b4ed0ae6a14256a561b0b0cb5c693

    • SHA256

      6d182b71073138fd1cf35b5ecc4427023632ea7fa4c4b1797c112185780197ca

    • SHA512

      07e95cf36f08a702a07c21e4c59c93ea9bbdf4ff91c705c57894108b95d10cc1bc140654ac29aca8dc3cfaa57578b5806be184a43b50b8b1a2f754bb1588b6b9

    • SSDEEP

      1536:JxqjQ+P04wsmJCDNu4GhQkfnLq01weW5yX3jFxv44fvQ+P04wsmJC:sr85ChTGhQl3yRr85C

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

    • Neshta family

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

MITRE ATT&CK Enterprise v15

Tasks